Watch for alerting when Topbeat collectors are no longer reporting new data.

topbeat_not_reporting.json

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "metadata": {
    "skip_hosts": [""],
    "window_size": "2m",
    "collection_scope": "48h"
  },
  "input": {
    "search": {
      "request": {
        "indices": "topbeat-*",
        "body": {
          "size": 0,
          "aggs": {
            "hostpool": {
              "terms": {
                "field": "beat.hostname",
                "exclude": ["{{#ctx.metadata.skip_hosts}}","{{.}}","{{/ctx.metadata.skip_hosts}}"]
              },
              "aggs": {
                "window": {
                  "filter": {
                    "range": {
                      "@timestamp": {
                        "gte": "now-{{ctx.metadata.window_size}}"
                      }
                    }
                  }
                }
              }
            }
          },
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "gt": "now-{{ctx.metadata.collection_scope}}/m"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "array_compare": {
      "ctx.payload.aggregations.hostpool.buckets": {
        "path": "window.doc_count",
        "eq": {
          "value": 0
        }
      }
    }
  },
  "actions": {
    "log": {
      "transform": {
        "script": "return ctx.payload.aggregations.hostpool.buckets.findAll { it.window.doc_count == 0 }"
      },
      "logging": {
        "text": "{{ctx.execution_time}} {{ctx.watch_id}} Watch execution: check hosts{{#ctx.payload._value}} {{key}}{{/ctx.payload._value}}"
      }
    }
  }
}